The researchers received the award for their discovery of a previously unknown tracking technique, which silently tracks users between web browsers and mobile applications without informing them. The research is described in their paper 'Bridges to Self: Silent Web-to-App Tracking on Mobile via Localhost'.
Hidden tracking
The research shows how Meta and Yandex can circumvent the privacy safeguards between web and app environments on Android devices. This allowed Meta and Yandex to link data from web browsers to their own Android apps, including Facebook, Instagram, Yandex Maps and Yandex Search.
By embedding tracking code in millions of websites, Meta's Pixel and Yandex Metrica were able to map the browsing behaviour of Android users based on their persistent identity (i.e. with the account holder logged in). This method circumvents the privacy protection offered by Android's permission controls and even browsers' incognito mode, affecting all major Android browsers.
Impact
The international research team, including researchers from IMDEA Networks (Spain) and KU Leuven (Belgium), reported the issue to several browser vendors, mobile platforms and data protection agencies. In response, multiple vendors have developed or announced measures to counter this form of tracking.
Gunes Acar, who made the initial discovery, said: "By revealing this previously unknown tracking method, our investigation led to concrete changes in browsers, mobile platforms and web standards. We are pleased that our disclosure has improved privacy for billions of users, and honoured that this contribution has been recognized with such a prestigious award."
About the CNIL-Inria Privacy Award
The CNIL-Inria Privacy Award has been presented annually since 2016 by the CNIL, the French data protection authority (comparable to the Dutch Data Protection Authority), and Inria, the French national research institute for computer science and digital sciences. Through this scientific award, the organisations aim to promote research in computer science and privacy protection and to raise awareness of privacy and personal data protection among both the general public and policymakers.
